On Fri, Jul 01, 2016 at 03:33:07PM +0100, Daniel P. Berrange wrote: > On Fri, Jul 01, 2016 at 04:30:44PM +0200, Andrea Bolognani wrote: > > audit is using cap-ng itself since version 2.6.1, and it gets > > to initialize the internal state of the cap-ng library before > > we call fork(). Because of that, our own use of cap-ng in the > > child process ends up attempting to change the capabilities of > > the parent process instead of the child process, which fails. > > > > Calling capng_setpid() before using any other cap-ng API > > ensures we're altering the capabilities of the right process. > > I really don't want to do any hack workaround in libvirt until we've > got feedback from the cap-ng maintainers, as I think it is really > their bug to fix. FYI, I attached a patch for libcap-ng whic uses pthread_atfork to reset their global state https://bugzilla.redhat.com/show_bug.cgi?id=1352064 It works with my demo program, but haven't tested with libvirt yet Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list